The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes several Node.js scripts that use child_process.execSync to interact with system utilities. Specifically, change-archive.mjs invokes the zip command to package change artifacts, and lib/index.mjs uses git rev-parse and git diff for provenance and drift detection. Security risks are mitigated through input sanitization: change IDs are filtered to alphanumeric characters and hyphens, and Git SHAs are validated against a strict hexadecimal regex ([a-f0-9]{7,40}).
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the repository, such as architecture.md and CONTEXT.md, to drive its specification and verification phases. It employs a subagent in Phase 3 to perform a 'dry run' of implementation steps based on these files. While this creates a surface for indirect injection, the risk is inherent to the skill's primary function as a development assistant. The data extraction is handled via specific regex patterns, reducing the likelihood of the agent misinterpreting embedded instructions as commands.
[DATA_EXPOSURE]: The tool manages local configuration files (manifest.yaml) and architectural documents. It does not access sensitive system directories (like .ssh or .aws) or environment variables containing secrets. The archiving process targets only the .changes/active/ directory, which is intended for these artifacts.

specify